Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
High 7.7
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
-
Medium 4.2
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
-
Medium 5.5
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.5…
-
High 8.1
In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-p…
-
Medium 4.3
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
-
High 7.5
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
-
Medium 5.5
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
-
High 8.7
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature
-
Medium 6.5
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
-
Medium 6.5
In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files
-
Medium 4.7
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
-
Medium 5.5
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
-
Medium 5.5
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
-
Medium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
-
Medium 5.8
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
-
Medium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
-
Medium 4.8
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
-
Medium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependen…
-
High 7.5
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
-
High 7.7
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
-
Low 3.7
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
-
Medium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
-
Medium 6.1
In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in wi…
-
High 7.6
In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was poss…
-
Medium 4.3
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
-
Medium 4.8
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
-
Medium 5.4CVE-2025-52876 EPSS 39%
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
-
Medium 4.8CVE-2025-52877 EPSS 37%
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
-
Medium 5.4
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
-
Medium 4.3
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
-
Medium 4.3
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
-
High 7.7
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API
-
Low 3.5CVE-2025-46618 EPSS 63%
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
-
Medium 4.3
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs
-
Medium 4.9
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
-
Medium 5.4
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session